3.1 Public, Private, and Hybrid Cloud Models

Quick Answer: A public cloud is built and operated by a provider and sold to many customers on shared hardware. Microsoft 365 is public-cloud SaaS. A private cloud is dedicated to one organization and only counts as “cloud” when the datacenter behaves like a cloud — virtualization, automation, and self-service — not when someone merely locks down a tenant. A hybrid cloud joins public and private (or on-premises) environments so mailboxes, identities, and files can live in both places at once.

Exam context

The April 30, 2025 MS-900 skills outline asks you to describe public, private, and hybrid cloud models under Describe the benefits of and considerations for using cloud, hybrid, or on-premises services. Cloud concepts are only 5–10% of the exam, but the stems are almost always scenarios. Microsoft is not asking you to design Azure landing zones. It is asking whether you can tell a deployment model (where the cloud runs, and for whom) from a service model (SaaS, PaaS, IaaS — Chapter 2) and from hybrid work (how people work — Section 3.3).

Microsoft Learn’s “Define cloud models” unit names three main models: private, public, and hybrid. It then mentions multicloud as a fourth, increasingly common situation: using two or more public providers at once. Community cloud is a NIST research term and is not on the official MS-900 bullet list. Do not invent it as a required fourth answer.

Public cloud

A public cloud is built, controlled, and maintained by a third-party provider. Anyone who purchases the service can use it. That “general public availability” is the official Learn contrast with private cloud.

Microsoft’s public-cloud characteristics that show up on fundamentals exams:

• Provider ownership. Microsoft owns the datacenters, physical hosts, and fabric that run Exchange Online, SharePoint, Teams, and the Microsoft 365 Apps.
• Multi-tenant. Many organizations share physical infrastructure. Each tenant’s data and identities are logically isolated. Isolation is not the same thing as a private cloud.
• Pay for what you use. You buy subscriptions and consume services. You do not buy the building.
• Fast provision and deprovision. Create a user, assign a license, and the mailbox and OneDrive exist in minutes.
• You do not have complete control over the underlying hardware or fabric security. Microsoft operates that layer.

Microsoft 365 is public-cloud SaaS. Signing up for a tenant does not move you into a private cloud. Conditional Access, sensitivity labels, customer-managed keys, and a dedicated Microsoft 365 admin center make the tenant more tightly governed. They do not change the deployment model. The workload still runs on Microsoft’s multi-tenant public cloud.

Public-cloud Microsoft 365 examples you should be able to name: Exchange Online mailboxes, SharePoint team sites, OneDrive for Business, Teams meetings and chat, Microsoft 365 Apps streamed or installed from the cloud, and Intune device management delivered as a cloud service.

Public cloud is the default answer when the scenario says “no servers to buy,” “scale for a product launch,” “users around the world,” or “start a new company this quarter.”

Private cloud

A private cloud is used by a single entity. Microsoft Learn describes it as the traditional datacenter model evolved: IT still delivers services over a network, but the resources stay dedicated. It may sit in your on-site datacenter or in a dedicated offsite facility, including one run by a third party. What matters is exclusive use, not the street address.

Official Learn trade-offs:

• Complete control over resources and security.
• Data is not collocated with other tenants’ data.
• Hardware must be purchased for startup and maintenance — classic capital expenditure.
• You remain responsible for hardware maintenance and updates.

Microsoft’s own public-cloud FAQ draws a line students miss: an on-premises datacenter is not automatically a private cloud. It becomes one when it uses cloud technologies such as virtualization, automation, and self-service provisioning. A locked closet of file servers with tickets for every new share is traditional infrastructure, not a private cloud.

Equally important: a Microsoft 365 tenant with extra security is not a private cloud. That is still public-cloud SaaS with stronger customer controls. Private cloud means the compute fabric is dedicated and cloud-like, not that the SaaS tenant has more policies.

Private cloud shows up when a hospital, government agency, or manufacturer must keep a system on dedicated hardware, needs predictable local performance, or must run software that cannot move. In a Microsoft 365 conversation, the private side is often the remaining on-premises Active Directory, Exchange servers, or line-of-business apps — if those systems are operated as a cloud-like fabric. If they are just leftover servers, call them on-premises, not private cloud, unless the scenario clearly describes self-service cloud characteristics.

Hybrid cloud

A hybrid cloud uses public and private clouds in an interconnected environment. Learn’s stock uses: let a private environment surge into the public cloud for temporary demand, and let the organization choose which services stay private for security, compliance, or legal reasons. The comparison table on that unit says hybrid provides the most flexibility and lets you determine where to run applications.

For MS-900, hybrid almost always means Microsoft 365 public SaaS connected to something that still lives in the customer’s environment. Three exam-ready examples:

Exchange hybrid. Microsoft’s Exchange hybrid documentation describes a single-organization look and feel between on-premises Exchange and Exchange Online. Users keep the same SMTP namespace (both sides use @contoso.com). There is a unified global address list, free/busy and calendar sharing, secure mail routing, the ability to move mailboxes either direction, and optional centralized mail transport through the on-premises org. Hybrid can be a long-term coexistence model or a stepping stone to a full Exchange Online move. Directory synchronization is required.

Microsoft Entra Connect hybrid identity. Microsoft 365 integration guidance says you can synchronize on-premises Active Directory Domain Services accounts into Microsoft Entra ID so you do not recreate every user. Add password hash synchronization or pass-through authentication so the password is the same in both places, or configure single sign-on (often with federation) so users sign in with on-premises credentials. Microsoft Entra Connect replaced older DirSync and Azure AD Sync tools. Identity depth belongs in Chapter 10; here you only need the model: one person, one account, two environments.

File share plus OneDrive. Many organizations keep departmental shares on-premises for scanners, shop-floor PCs, or latency-sensitive design files, while knowledge workers sync Desktop, Documents, and Pictures to OneDrive (Known Folder Move) and collaborate on SharePoint libraries. That is hybrid file storage: the public cloud holds roaming personal and team content; the on-premises share remains for workloads that are not ready to move.

Hybrid is the answer when the stem says “keep some mailboxes on-premises,” “sync Active Directory,” “users already have file servers,” “move in stages,” or “burst extra capacity without throwing away existing hardware.”

Multi-cloud, briefly

Microsoft Learn describes multicloud as using multiple public cloud providers — different features, or a migration from one provider to another. You then manage resources and security in both. It is useful vocabulary. It is not one of the three official MS-900 named models, and it is not the same as hybrid. Hybrid joins public with private or on-premises. Multi-cloud joins two public clouds.

How to pick the model on a scenario

On the exam: Deployment model answers where it runs and who it is dedicated to. Service model answers how much of the stack Microsoft manages. Hybrid work answers where people sit. Do not mix the three.